Senior Staff Engineer, Security AI-SOC

This is a fully remote position, open to applicants in California.

📋 Description

• Design and implement post-detection workflows, which include autonomous triage, agentic investigation, evidence synthesis, and containment orchestration.

• Develop production-level reasoning systems utilizing LLMs, embeddings, and context graphs.

• Formulate hypotheses, collect evidence, and provide explainable conclusions.

• Ingest high-quality detection signals from Cribl Detect to initiate automated investigations and responses.

• Investigate agentic paradigms, multi-agent frameworks, and natural language SOC interfaces through functional prototypes.

• Create core abstractions and develop protocols for agent communication.

• Review critical code and establish benchmarks for model accuracy, latency, and system dependability.

• Construct safe execution frameworks that include transparent reasoning trails, chains of custody, and human-in-the-loop controls.

• Collaborate with product managers, security researchers, and stakeholders to transform ambiguous concepts into technical strategies and actionable plans.

• Mentor engineering talent and advocate for Cribl’s AI SOC vision through architecture reviews, technical blogs, and discussions.

• Participate in stand-by, on-call, or off-hours responsibilities.

⛳️ Requirements

• Bachelor’s degree in Computer Science, Electrical Engineering, or a related field (Master’s degree is preferred).

• Over 12 years of experience in developing scalable production software.

• Proven experience in leading engineering initiatives and building AI SOC, SOAR, or post-detection automation capabilities at scale.

• Proficiency in building and deploying production-quality AI systems using LLM orchestration frameworks, agent swarms, vector databases/embeddings, dynamic tool invocation, and RAG architectures.

• Demonstrated experience in designing and operating scalable, low-latency distributed systems that manage asynchronous event processing and complex, multi-system workflow state machines.

• In-depth understanding of security analyst workflows and MITRE ATT&CK framework.

• Experience in designing robust and extensible API frameworks for third-party security platforms, such as EDR, Identity Providers, Cloud Infrastructure, and SIEM/SOAR.

• Capability to lead ambiguous, highly autonomous projects from concept through to production rollout.

• Experience in developing autonomous agent frameworks for security applications.

• Proficiency in JavaScript/TypeScript, NodeJS, or Go/Python within enterprise systems.

• Background in graph databases or contextual graph models that represent identities, endpoints, and threat histories.

• Active contributions to open-source projects in AI, agentic automation, or security domains.

• Strong communication skills in remote, distributed teams.

• Willingness to perform stand-by, on-call, or off-hours duties.

🏝️ Benefits

• Health insurance

• Dental insurance

• Vision insurance

• Short-term disability insurance

• Life insurance

• Paid holidays

• Paid time off

• Fertility treatment benefit

• 401(k)

• Equity

• Cribl Corporate Bonus Program

• Fully remote work

• Global, remote-first work culture